{"affected":[{"defaultStatus":"unknown","product":"Gallery for Social Photo","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0.41","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105967","cwes":["CWE-918"],"description":"The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/30dffd34-b7e5-4afc-809b-abb5c9d20590/"}],"kev":null,"metrics":[],"modifiedAt":1793685623747,"publishedAt":1793685623747,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/30dffd34-b7e5-4afc-809b-abb5c9d20590/"}],"remediation":[],"revision":"e38cc2f3169988536bd574e04d4176ba5219cebfb0acb42c7c611dee7240b5bb","sources":[{"modifiedAt":1793685623747,"name":"CNA: WPScan","retrievedAt":1793686107366,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105967"}],"ssvc":null,"status":"published","title":"Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter","updatedAt":1793686107366}